/**
 * `cortex login [server-url] [--server <url>]` — device-code flow against
 * pyre-web (RFC 8628), followed by a tenant-list fetch so one login
 * picks up every tenant the user belongs to.
 *
 * Server URL resolution (no hardcoded default — strict):
 *   1. positional arg:  `cortex login https://pyre.sh`
 *   2. --server flag:   `cortex login --server https://pyre.sh`
 *   3. PYRE_API_URL env
 * If none provided, exits 1 with a clear error. The "no hardcoded
 * environment URLs" rule means the binary stays decoupled from any
 * single deployment.
 *
 * Two-step flow:
 *
 *   1. Device-code: POST {api_url}/api/auth/device-code with
 *      `scopes: ["cortex:tenants", "cortex:invoke"]`. pyre-web mints a
 *      user-scoped session token (not a tenant-scoped api-key) and
 *      returns the bearer on first successful poll.
 *
 *   2. Tenant enumeration: GET {api_url}/api/cortex/tenants with that
 *      bearer. Returns every running Cortex deployment the user can
 *      reach via memberships[]. Pro users get one entry; enterprise
 *      users with multiple memberships get one per tenant.
 *
 * The user-token + canonical api_url go into the shared
 * ~/.pyre/credentials.json's base fields (matching engram/persona's
 * convention). The per-tenant mcp_url + bearer pairs go into the
 * cortex.tenants[] array there. active_tenant defaults to the first
 * tenant; use `cortex tenant switch <slug>` to change.
 *
 * Backward compat: nothing. The legacy /api/cortex/device/* endpoints
 * are deprecated. Users on old credentials keep working until their
 * bearer expires; re-running `cortex login` upgrades them.
 */
export interface LoginOptions {
    /** pyre-web base URL — required. Caller resolves from arg/flag/env. */
    apiUrl: string;
    /** Override hostname (tests). */
    deviceName?: string;
    /** Override the writes-to-disk target (tests). */
    credentialsFile?: string;
    /** Override the "open in browser" hook (tests). */
    openBrowser?: (url: string) => void;
    /** Override fetch (tests). */
    fetchImpl?: typeof fetch;
    /** Override sleep (tests). */
    sleep?: (ms: number) => Promise<void>;
    /** Override Date.now (tests). */
    now?: () => number;
}
/**
 * Resolve the server URL from positional arg / --server flag / env.
 * Returns null when none of the three gave us a URL.
 */
export declare function resolveServerUrl(opts: {
    positional?: string;
    flag?: string;
}): string | null;
/**
 * Run the login flow end-to-end. Returns 0 on success, non-zero on
 * failure. User-visible messages go to stdout (success) / stderr (errors).
 */
export declare function runLoginFlow(opts: LoginOptions): Promise<number>;
/**
 * CLI entry point — parses argv, resolves the server URL, runs the flow.
 * Kept thin so runLoginFlow stays unit-testable without a process.argv.
 */
export declare function runLogin(args: string[]): Promise<number>;
//# sourceMappingURL=login.d.ts.map